Blog
Demos, implementation guides, product updates and broader takes on authorization, identity and security. Written for the engineers, architects, security, identity and product leaders shaping how their teams ship and govern access.
Best IAM solutions for enterprises in 2026
The best IAM solutions for enterprises, broken down by domain. Access management, identity governance, privileged access, machine identity, and authorization, with the notable vendors in each and how to choose, including the fine-grained authorization layer most enterprise identity programs leave hardcoded.
Who owns authorization in a large engineering organization?
A guide to authorization governance across teams. Covers Conway's law and IAM silos, the incident and cloud-cost price of an unowned decision, the layered ownership split the analyst frameworks converge on, and how to start - a layer-by-layer template for deciding who owns what.
Cerbos PDP v0.56.0: Rule table observability, and Cerbos Hub audit log targeting
Cerbos PDP v0.56.0 makes store reloads confirm that policies compiled, adds a rule table refresh metric and Cerbos Hub audit log targeting, and tightens policy validation and matching.
ZITADEL alternatives
ZITADEL alternatives compared by the reason you are leaving, from the AGPL license and free tier limits to operations and tenancy fit. Covers Keycloak, Authentik, Authelia, Ory, and managed options, and how to tell whether permissions, not the identity provider, are the layer that is failing
Hand the application a query filter, not a per row authorization decision
Per record authorization breaks when an application renders a list. This guide covers asking the policy engine what a user can see, turning a query plan into a database predicate, where AuthZEN search endpoints fit, and why translating to SQL, ORM or vector filters belongs in one place.
Read authorization attributes from the database, not a copy
Authorization attributes like plan tier, team and clearance already live in a database. How Cerbos Synapse fetches them at decision time with a SQL data source and a Starlark proxy extension, how to set cache TTL per attribute, and how checks fail closed when the database is unreachable.
Gluu vs Keycloak
A current comparison of Gluu and Keycloak for identity teams, covering the Janssen Project and Flex split, Keycloak's CNCF position, and where each project's authorization engine runs out of room.
Kafka topic authorization belongs in your policy set, not in a per cluster ACL list
Kafka ACLs accumulate per cluster. This guide covers how Kafka's pluggable authorizer hands topic access decisions to an external policy engine, how ACL bindings map onto resource policies, caching and fail closed tradeoffs on the broker hot path, and what moves topic access into one audited policy set.
Cerbos named a Sample Vendor for AuthZEN in the Gartner® Hype Cycle™ for Digital Identity, 2026
The Gartner Hype Cycle for Digital Identity, 2026 includes AuthZEN as a category, with Cerbos named as a Sample Vendor. We cover what the OpenID AuthZEN standard does, why interoperable authorization matters as AI agents spread, and where Cerbos fits.
Rich Authorization Requests (RAR) for agent tokens
OAuth scopes can say read the profile, not transfer 45 euros to this merchant. Here is how Rich Authorization Requests express precise, per-hop grants for AI agents.
The Cerbos PDP dashboard is now on Grafana Cloud
The Cerbos PDP dashboard is now on the Grafana Cloud dashboards site. Import it by ID, point it at your Prometheus data source, and every instance in your fleet is on one screen, from health and loaded policy count down to latency percentiles.
Best zero trust security tools and solutions for 2026
The best zero trust security tools and solutions, broken down by layer. Identity and access management, privileged access, zero trust network access, device trust, authorization and policy enforcement, data protection, and visibility, with the notable tools in each and how to prioritize the layer most stacks leave hardcoded.
Why your audit trail breaks at the sub-agent boundary
When agent A delegates to agent B, the downstream logs show the service account, not the user. Here is why the audit trail breaks at the sub-agent boundary, and how to fix it.
Keycloak vs Ory
Compare Keycloak and Ory on architecture, login UI, federation and operational load, and see where each one's authorization model stops.
LDAP and Active Directory authorization without changing the application
LDAP and Active Directory groups encode the access rules for applications nobody will fund a rewrite for. Covers resolving those groups at the proxy in front of the application, turning them into an input to policy rather than the access model itself, cache staleness, and where boundary enforcement stops.
Cerbos Hub has a new interface
Cerbos Hub has a new interface. Dark and light themes that follow your system, an organization and workspace switcher on every screen, more rows per page in policy lists and audit logs, and improved accessibility. Nothing to migrate and no action needed.
Identity Week America 2026: Same AI agent authorization problem, different badges
Notes from Identity Week America 2026 in Washington DC, where federal agencies, defense contractors and SaaS teams brought the same AI agent authorization question to the booth. Covers the License to Thrill panel, agent ownership and blast radius, policy based access control at runtime, and why audit is still unsolved.
Per-hop PBAC: enforcing scope at every delegation step
Checking authorization once at the edge leaves every downstream hop unguarded. Here is why agent delegation needs a policy decision at every hop, and how to do it.
Recommended content
Mapping business requirements to authorization policy
eBook: Zero Trust for AI, securing MCP servers
Experiment, learn, and prototype with Cerbos Playground
eBook: How to adopt externalized authorization
Framework for evaluating authorization providers and solutions
